Right, debugging internal communications was all I could think of. I come down on the side of denying unwanted traffic instead of communicating with the sender.
I'd forgotten the 'reject' option... Has anyone ever employed it? Why?
One example: Reject is useful for SMTP connections to remote servers which insist on trying to do an IDENT connection back to you. If you just drop them, it greatly slows down your outgoing mail queues.
Remote mail server tries to make IDENT connection back... it would only show up in PF log if you're dropping.
Slowdown is because if you drop, the remote will try several times, waiting for the IP timeout each time, so it can take 1 minute or more to send a single email.
There were some discussions of this on these forums many years ago.
The solution is to either forward/allow the traffic to your server, or just reject the traffic. Ironically, there's no advantage to allowing it.
So, do you reject IDENT traffic in any of your clients' boxes? After a little googling, it looks like you're not alone - should this be a part of the standard setup when the box is shipped from Astaro?
So, do you reject IDENT traffic in any of your clients' boxes? After a little googling, it looks like you're not alone - should this be a part of the standard setup when the box is shipped from Astaro?
So, do you reject IDENT traffic in any of your clients' boxes? After a little googling, it looks like you're not alone - should this be a part of the standard setup when the box is shipped from Astaro?
Yes, anywhere we send outgoing mail from without a smarthost (or the smarthost is behind the firewall). Some smarthosts probably do IDENT too; it doesn't hurt to add a REJECT rule to any firewall, unless you need IDENT for IRC or something.
